CVE-2026-12196 describes a broken access control vulnerability in the HestiaCP panel's cronjob feature. Specifically, low privilege users can alter cronjobs to run HestiaCP management scripts with passwordless sudo privileges. This escalates their privileges to administrator level within the application and potentially the underlying webserver. The vulnerability is categorized under CWE-287 (Improper Authentication). The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required initially, no user interaction, and high impact on confidentiality and system control. No patch or remediation details are provided in the available data.

Exploitation of this vulnerability allows low privilege users to gain administrator-level access to the HestiaCP panel and potentially full control over the underlying webserver. This can lead to complete system compromise, unauthorized access to sensitive data, and disruption of services.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the cronjob feature to trusted users only and monitor for unauthorized modifications. Avoid granting passwordless sudo permissions to scripts accessible by low privilege users.